Aspects of the disclosure relate to using cognitive automation for enhanced atm security. A computing platform may receive, from a first automated teller machine (atm), first atm information indicating a first interaction between a user and the first atm. The computing platform may receive, from a first camera, a first image, which may show the user performing the first interaction with the first atm. Based on the first atm information and the first image, the computing platform may determine that the first atm is experiencing malicious activity. The computing platform may send, to a second atm, one or more commands directing the second atm to perform a first security action, which may cause the second atm to perform the first security action.
|
10. A method comprising:
at a computing platform comprising at least one processor, a communication interface, and memory:
receiving, from a first automated teller machine (atm), first atm information, wherein the first atm information indicates a first interaction between a user and the first atm;
receiving, from a first camera, a first image, wherein the first image shows the user performing the first interaction with the first atm;
determining, based on the first atm information and the first image, that the first atm is experiencing malicious activity, wherein determining that the first atm is experiencing malicious activity comprises determining that a same user interface progression has been accessed at a number of atms within a predetermined distance, wherein the number of atms exceeds a threshold number of atms, and wherein different access credentials were used to access at least two atms of the number of atms;
sending, to a second atm, one or more commands directing the second atm to perform a first security action, wherein sending the one or more commands directing the second atm to perform the first security action causes the second atm to perform the first security action; and
wherein the first security action comprises:
causing display of one or more graphical user interfaces to be displayed at the second atm which may delay the user from completing the malicious activity, wherein the one or more graphical user interfaces indicate that a different withdrawal amount than was requested by the user; and
dispensing the different withdrawal amount than was request requested by the user, wherein the computing platform notifies law enforcement of the malicious activity during the delay.
18. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
receive, from a first automated teller machine (atm), first atm information, wherein the first atm information indicates a first interaction between a user and the first atm;
receive, from a first camera, a first image, wherein the first image shows the user performing the first interaction with the first atm;
determine, based on the first atm information and the first image, that the first atm is experiencing malicious activity, wherein determining that the first atm is experiencing malicious activity comprises determining that a same user interface progression has been accessed at a number of atms within a predetermined distance, wherein the number of atms exceeds a threshold number of atms, and wherein different access credentials were used to access at least two atms of the number of atms;
send, to a second atm, one or more commands directing the second atm to perform a first security action, wherein sending the one or more commands directing the second atm to perform the first security action causes the second atm to perform the first security action; and
wherein the first security action comprises:
causing display of one or more graphical user interfaces to be displayed at the second atm which may delay the user from completing the malicious activity, wherein the one or more graphical user interfaces indicate that a different withdrawal amount than was requested by the user; and
dispensing the different withdrawal amount than was request requested by the user, wherein the computing platform notifies law enforcement of the malicious activity during the delay.
1. A computing platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, from a first automated teller machine (atm), first atm information, wherein the first atm information indicates a first interaction between a user and the first atm; receive, from a first camera, a first image, wherein the first image shows the user performing the first interaction with the first atm; determine, based on the first atm information and the first image, that the first atm is experiencing malicious activity, wherein determining that the first atm is experiencing malicious activity comprises determining that a same user interface progression has been accessed at a number of atms within a predetermined distance, wherein the number of atms exceeds a threshold number of atms, and wherein different access credentials were used to access at least two atms of the number of atms;
send, to a second atm, one or more commands directing the second atm to perform a first security action, wherein sending the one or more commands directing the second atm to perform the first security action causes the second atm to perform the first security action; and
wherein the first security action comprises:
causing display of one or more graphical user interfaces to be displayed at the second atm which may delay the user from completing the malicious activity, wherein the one or more graphical user interfaces indicate a different withdrawal amount than was requested by the user; and
dispensing the different withdrawal amount than was requested by the user, wherein the computing platform notifies law enforcement of the malicious activity during the delay.
2. The computing platform of
receive, from the second atm, second atm information, wherein the second atm information indicates a second interaction between the user and the second atm;
receive, from a second camera, a second image, wherein the second image shows the user performing the second interaction with the second atm; and
compare the first image to the second image, wherein the comparison results in identifying that the user performing the second interaction is the same user that performed the first interaction.
3. The computing platform of
4. The computing platform of
5. The computing platform of
6. The computing platform of
that a same personal identification number has been used more than a predetermined number of times during a predetermined time period, or
that an amount of funds within a predetermined amount of a maximum withdrawal limit has been withdrawn from the number of atms within the predetermined distance a number of times that exceeds a predetermined withdrawal threshold.
7. The computing platform of
receive, from a second camera, a second image, wherein the second image shows the user performing the first interaction with the first atm from a different vantage point than the first image, wherein determining that the first atm is experiencing malicious activity is further based on the second image.
8. The computing platform of
comparing the first image to a stored user profile corresponding to a legitimate user, and
identifying, based on the comparison of the first image to the stored user profile, that the user is not the legitimate user.
9. The computing platform of
receive, from the first camera, audio data, wherein the audio data includes speech from the user performing the first interaction with the first atm, wherein determining that the first atm is experiencing malicious activity comprises:
comparing the audio data to a stored user profile corresponding to a legitimate user, and
identifying, based on the comparison of the audio data to the stored user profile, that the user is not the legitimate user.
11. The method of
receiving, from a second camera, a second image, wherein the second image shows the user performing the second interaction with the second atm; and
comparing the first image to the second image, wherein the comparison results in identifying that the user performing the second interaction is the same user that performed the first interaction.
12. The method of
13. The method of
14. The method of
15. The method of
that a same personal identification number has been used more than a predetermined number of times during a predetermined time period, or
that an amount of funds within a predetermined amount of a maximum withdrawal limit has been withdrawn from the number of atms within the predetermined distance a number of times that exceeds a predetermined withdrawal threshold.
16. The method of
17. The method of
comparing the first image to a stored user profile corresponding to a legitimate user, and
identifying, based on the comparison of the first image to the stored user profile, that the user is not the legitimate user.
|
|||||||||||||||||||||||||
Aspects of the disclosure relate to automated teller machine (ATM) security. In particular, one or more aspects of the disclosure relate to computing platforms that apply cognitive automation technology to securing ATMs.
In some cases, enterprise organizations such as financial institutions may deploy ATMs to allow customers to perform basic financial tasks (e.g., deposits, withdrawals, funds transfers, or the like). In some instances, individuals may tamper with these ATMs, and such tampering may remain undetected due to the automated, standalone nature of the ATMs. Furthermore, ATMs may operate as isolated units and might not communicate with each other. This configuration may increase the risk of issues such as undetected tampering and/or repeated tampering at additional ATMs, which in turn may result in processing inefficiencies and/or security threats for financial institutions that operate and/or otherwise utilize ATMs.
Aspects of the disclosure provide effective, efficient, scalable, and convenient technical solutions that address and overcome the technical problems associated with ATM security. For example, some aspects of the disclosure provide techniques that may enable computing platforms to apply cognitive automation technology to enhance ATM security by monitoring and analyzing interaction patterns at the ATMs to identify malicious activity. The computing platforms may share malicious interaction patterns and/or images of malicious actors to facilitate identification and/or execution of various responsive actions.
Accordingly, by performing the one or more methods described herein, one or more technical advantages may be realized. For example, one technical advantage of using cognitive automation in ATM security is that such techniques may expedite computing methods that enable identification of malicious interactions. This approach may notify other ATMs of identified tampering and image data corresponding to the malicious user. Accordingly, subsequently-attacked ATMs and/or a central server receiving data from such subsequently-attacked ATMs may avoid expending time and computing resources to classify an interaction as malicious. Rather, the subsequently-attacked ATM may simply capture an image of an interaction at the subsequent ATM, perform an image comparison to identify that a user identified at the subsequently-attacked ATM was previously identified as tampering with another ATM, and perform necessary security measures if the comparison yields a match.
In accordance with one or more embodiments of the disclosure, a computing platform comprising at least one processor, a communication interface, and memory storing computer-readable instructions may receive, from a first automated teller machine (ATM), first ATM information indicating a first interaction between a user and the first ATM. The computing platform may receive, from a first camera, a first image showing the user performing the first interaction with the first ATM. Based on the first ATM information and the first image, the computing platform may determine that the first ATM is experiencing malicious activity. The computing platform may send, to a second ATM, one or more commands directing the second ATM to perform a first security action, which may cause the second ATM to perform the first security action.
In one or more embodiments, the computing platform may receive, from the second ATM, second ATM information indicating a second interaction between the user and the second ATM. The computing platform may receive, from a second camera, a second image showing the user performing the second interaction with the second ATM. The computing platform may compare the first image to the second image, which may result in identifying that the user performing the second interaction is the same user that performed the first interaction.
In one or more embodiments, the computing platform may compare the first image to the second image by applying computer vision techniques to identify the user in the first image and the second image. In one or more embodiments, the computing platform may send the one or more commands directing the second ATM to perform the first security action in response to identifying that the user performing the second interaction is the same user that performed the first interaction.
In one or more embodiments, the computing platform may receive the first image concurrently with the first ATM information and the first camera may be located within a predetermined distance of the first ATM. In one or more embodiments, in determining that the first ATM is experiencing malicious activity, the computing platform may determine one or more of: 1) that the first ATM is being physically deconstructed, 2) that the same personal identification number has been used more than a predetermined number of times during a predetermined time period, 3) that the same user interface progression has been accessed at a number of ATMs within a predetermined distance that exceeds a predetermined progression threshold, or 4) that an amount of funds within a predetermined amount of a maximum withdrawal limit has been withdrawn from the number of ATMs within the predetermined distance a number of times that exceeds a predetermined withdrawal threshold.
In one or more embodiments, the computing platform may receive, from a second camera, a second image showing the user performing the first interaction with the first ATM from a different vantage point than the first image, and the computing platform may determine that the first ATM is experiencing malicious activity based in part on the second image. In one or more embodiments, the computing platform may determine that the first ATM is experiencing malicious activity by: 1) comparing the first image to a stored user profile corresponding to a legitimate user, and 2) identifying, based on the comparison of the first image to the stored user profile, that the user is not the legitimate user.
In one or more embodiments, the first security action may be one or more of: 1) notifying law enforcement of the malicious activity, 2) notifying an enterprise user device at a physical branch office of an enterprise organization maintaining the second ATM, 3) causing display of one or more graphical user interfaces to be displayed at the second ATM which may delay the user from completing the malicious activity, or 4) causing a physical perimeter surrounding the second ATM to be locked down. In one or more embodiments, the computing platform may receive, from the first camera, audio data that includes speech from the user performing the first interaction with the first ATM, and the computing platform may determine that the first ATM is experiencing malicious activity by: 1) comparing the audio data a stored user profile corresponding to a legitimate user, and 2) identifying, based on the comparison of the audio data to the stored user profile, that the user is not the legitimate user.
These features, along with many others, are discussed in greater detail below.
The present disclosure is illustrated by way of example and not limited in the accompanying figures in which like reference numerals indicate similar elements and in which:
In the following description of various illustrative embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown, by way of illustration, various embodiments in which aspects of the disclosure may be practiced. In some instances, other embodiments may be utilized, and structural and functional modifications may be made, without departing from the scope of the present disclosure.
It is noted that various connections between elements are discussed in the following description. It is noted that these connections are general and, unless specified otherwise, may be direct or indirect, wired or wireless, and that the specification is not intended to be limiting in this respect.
As a brief introduction to the concepts described further herein, one or more aspects of the disclosure provide systems and methods to efficiently and effectively implement cognitive automation for enhanced ATM security. For example, one or more of the systems and methods described herein are directed towards integrating cognitive ability into ATMs to send out fraud alerts to neighboring ATMs when they detect tampering. In these instances, the ATM footage of a suspect may be sent to the neighboring ATMs and used to detect tampering, block access, and/or notify authorities without alerting the suspect.
Accordingly, by performing the one or more methods described herein, one or more technical advantages may be realized. For example, one technical advantage of using cognitive automation in ATM security is that such techniques may expedite computing methods corresponding to identification of malicious interactions. This approach may notify other ATMs of identified malicious interactions and image data corresponding to the malicious user. Accordingly, subsequently attacked ATMs may avoid expending time and computing resources to classify an interaction as malicious. Rather, the subsequent ATM may capture an image of an interaction at the subsequent ATM, compare the image to images from previously attacked ATMs, and perform necessary security measures if the comparison yields a match.
As described further below, cognitive automation platform 102 may be a computer system that includes one or more computing devices (e.g., servers, server blades, or the like) and/or other computer components (e.g., processors, memories, communication interfaces) that may be used to implement cognitive automation, machine learning algorithms, computer vision techniques, artificial intelligence, or the like to identify malicious interactions, recognize users, compare interaction patterns to stored profiles, detect tampering, and direct performance of security actions accordingly. In some instances, the cognitive automation platform 102 may be maintained by an enterprise organization (e.g., a financial institution, or the like) and may be configured to identify malicious interactions based on interaction patterns and/or detected impersonation, and may be configured to cause one or more security measures to be taken in response. In some instances, the cognitive automation platform 102 may be configured to maintain a cognitive automation model that stores correlations between user interaction information, user appearances, and/or voice characteristics, and may be configured to update the cognitive automation model based on received feedback.
First camera 103 may be a camera configured to capture video data, image data, audio data, or the like. In some instances, the first camera 103 may be located within a predetermined distance (e.g., within a kiosk, at a terminal, or the like) of an ATM (e.g., first ATM 105, or the like) and may be configured to collect data corresponding to user interactions with the ATM. In some instances, first camera 103 may be configured to communicate with cognitive automation platform 102, and may send the video data, image data, audio data, or the like accordingly.
Enterprise user device 104 may be a desktop computer, laptop computer, tablet, mobile device, or the like, and may be used by an individual such as an employee of an enterprise organization (e.g., a financial institution, or the like). For example, enterprise user device 104 may be configured to facilitate display of user interfaces (e.g., interfaces that allow the individual to provide financial services at a branch office such as perform withdrawals, deposits, fund transfers or the like). In some instances, enterprise user device 104 may be configured to communicate with cognitive automation platform 102 and may receive one or more alerts and/or notifications accordingly (e.g., notifications regarding malicious interactions with a proximate ATM, or the like).
First ATM 105 may be an ATM used by an individual such as a client of an enterprise organization (e.g., a financial institution, or the like) to perform financial services (e.g., withdrawal, deposit, transfer funds, or the like). In some instances, first ATM 105 may be configured to display or otherwise present one or more graphical user interfaces (e.g., automated teller interfaces) and may be configured to provide interaction information (e.g., withdrawal amounts, accessed accounts, navigation patterns, or the like) to the cognitive automation platform 102. In some instances, interactions with first ATM 105 may be monitored by one or more cameras (e.g., first camera 103, second camera 107, or the like).
Second ATM 106 may be an ATM used by an individual such as a client of an enterprise organization (e.g., a financial institution, or the like) to perform financial services (e.g., withdrawal, deposit, transfer funds, or the like). In some instances, second ATM 106 may be configured to display or otherwise present one or more graphical user interfaces (e.g., automated teller interfaces) and may be configured to provide interaction information (e.g., withdrawal amounts, accessed accounts, navigation patterns, or the like) to the cognitive automation platform 102. In some instances, second ATM 106 may be located within a predetermined distance of the first ATM 105 (e.g., within a bank of ATMs inside a kiosk, inside a lobby of a financial center, at a drive-through, outside of a financial center, or the like) or may be located at a different location. In some instances, first ATM 105 and second ATM 106 may be maintained by the same or different enterprise organizations. In some instances, interactions with first ATM 105 may be monitored by one or more cameras (e.g., first camera 103, second camera 107, or the like).
Second camera 107 may be a camera configured to capture video data, image data, audio data, or the like. In some instances, the second camera 107 may be located within a predetermined distance (e.g., within a kiosk, at a terminal, or the like) of an ATM (e.g., first ATM 105, second ATM 106 or the like) and may be configured to collect data corresponding to user interactions with the ATM. In these instances, the second camera 107 may be configured to capture a different vantage point of users interacting with the first ATM 105 than is captured by first camera 103. Additionally or alternatively, the second ATM 106 may be configured to capture users interacting with the second ATM 106. In some instances, second camera 107 may be configured to communicate with cognitive automation platform 102, and may send the video data, image data, audio data, or the like accordingly.
Computing environment 100 also may include one or more networks, which may interconnect cognitive automation platform 102, first camera 103, enterprise user device 104, first ATM 105, second ATM 106, second camera 107, or the like. For example, computing environment 100 may include a network 101 (which may interconnect, e.g., cognitive automation platform 102, first camera 103, enterprise user device 104, first ATM 105, second ATM 106, second camera 107, or the like).
In one or more arrangements, cognitive automation platform 102, first camera 103, enterprise user device 104, first ATM 105, second ATM 106, and second camera 107 may be any type of computing device capable of sending and/or receiving requests and processing the requests accordingly. For example, cognitive automation platform 102, first camera 103, enterprise user device 104, first ATM 105, second ATM 106, second camera 107, and/or the other systems included in computing environment 100 may, in some instances, be and/or include server computers, desktop computers, laptop computers, tablet computers, smart phones, or the like that may include one or more processors, memories, communication interfaces, storage devices, and/or other components. As noted above, and as illustrated in greater detail below, any and/or all of cognitive automation platform 102, first camera 103, enterprise user device 104, first ATM 105, second ATM 106, and/or second camera 107 may, in some instances, be special-purpose computing devices configured to perform specific functions.
Referring to
Cognitive automation module 112a may have instructions that direct and/or cause cognitive automation platform 102 to execute advanced cognitive automation techniques related to ATM security, as discussed in greater detail below. Cognitive automation database 112b may store information used by cognitive automation module 112a and/or cognitive automation platform 102 in application of cognitive automation techniques related to ATM security, and/or in performing other functions. Machine learning engine 112c may have instructions that direct and/or cause the cognitive automation platform 102 to set, define, and/or iteratively refine optimization rules and/or other parameters used by the cognitive automation platform 102 and/or other systems in computing environment 100.
At step 202, the first ATM 105 may send first ATM interaction information to the cognitive automation platform 102. For example, a first user may interact with the first ATM 105, and the first ATM 105 may send information corresponding to the interaction to the cognitive automation platform 102. In some instances, the first ATM 105 may send the first ATM interaction information to the cognitive automation platform 102 while the first wireless data connection is established. In some instances, in sending the first ATM interaction information, the first ATM 105 may send sensor information (e.g., indicating that the first ATM is being physically tampered with and/or deconstructed, that a card has been inserted (which may, e.g., be a genuine ATM card or a fake ATM card), that a universal serial bus (USB) device has been inserted, that a card skimmer has been installed, or the like), account information (e.g., a personal identification number (PIN) received), a user interface progression (e.g., user inputs received to move through a decision tree at the first ATM 105 to perform a particular action), an amount of funds withdrawn, a message indicating that software is being modified, biometric data, or the like.
At step 203, the cognitive automation platform 102 may receive the first ATM interaction information that was sent at step 202. In some instances, the cognitive automation platform 102 may receive the first ATM interaction information via the communication interface 113 and while the first wireless data connection is established. In some instances, in receiving the first ATM interaction information, the cognitive automation platform 102 may receive sensor information (e.g., indicating that the first ATM is being physically tampered with and/or deconstructed, or the like), account information (e.g., a personal identification number (PIN) received), a user interface progression (e.g., user inputs received to move through a decision tree at the first ATM 105 to perform a particular action), an amount of funds withdrawn, or the like.
At step 204, the first camera 103 may capture a first image. In some instances, the first camera 103 may be configured to capture images of a user interacting with the first ATM 105. In some instances, the first camera 103 may capture images at a predetermined interval (e.g., once a minute, or the like). In other instances, the first camera 103 may receive one or more commands from the cognitive automation platform 102, which may indicate that tampering has been detected (e.g., based on the first ATM interaction information, and that an image should be captured). In some instances, the first camera 103 may capture video content, images, audio content, or the like corresponding to the first user. In some instances, the first camera 103 may capture additional images related to the first user (e.g., a driver's license, license plate, or the like).
At step 205, the first camera 103 may establish a connection with the cognitive automation platform 102. For example, the first camera 103 may establish a second wireless data connection with the cognitive automation platform 102 to link the first camera 103 to the cognitive automation platform 102. In some instances, the first camera 103 may identify whether a connection is already established with the cognitive automation platform 102. If a connection is already established with the cognitive automation platform 102, the first camera 103 might not re-establish the connection. If a connection is not already established with the cognitive automation platform 102, first camera 103 may establish the second wireless data connection as described herein.
Referring to
At step 207, the cognitive automation platform 102 may receive the first image data sent at step 206. In some instances, the cognitive automation platform 102 may receive the first image data via the communication interface 113 and while the second wireless data connection is established. In some instances, the cognitive automation platform 102 may receive first image data corresponding to the first user interacting with the first ATM 105. In some instances, the cognitive automation platform 102 may receive video data, audio data, image data, or the like from the first camera 103. In some instances, in receiving the first image data, the cognitive automation platform 102 may receive a live video stream from the first camera 103. In some instances, steps 201-207 may occur concurrently (e.g., first ATM interaction information and first image data may be collected and sent to the cognitive automation platform 102 simultaneously). Alternatively, the first image data may be received prior to the first ATM interaction information, and may be used by the cognitive automation platform 102 to identify the first user before he or she begins interacting with the first ATM 105. Furthermore, it should be understood that although a single camera is described, multiple cameras may be implemented to collect images of the first user from multiple vantage points (which may, e.g., subsequently be used for threat identification at step 208).
At step 208, the cognitive automation platform 102 may identify a security threat based on the first ATM interaction information and/or the first image data. In some instances, the cognitive automation platform 102 may apply a cognitive automation model to the first ATM interaction information and/or the first image data to identify the security threat. For example, the cognitive automation platform 102 may maintain a model of known malicious interaction information, and may compare the first ATM interaction information to the known malicious interaction information. For example, the cognitive automation platform 102 may maintain sensor data indicating that a first ATM is being physically tampered with or deconstructed, and may compare the first ATM interaction information to the stored sensor data. Additionally or alternatively, the cognitive automation platform 102 may maintain a threshold value corresponding to a number of times that a PIN number may be used within a predetermined time period in a legitimate manner, and may compare the first ATM interaction information to this threshold value. For example, if the cognitive automation platform 102 determines, based on the first ATM interaction information, that the threshold value is exceeded, the cognitive automation platform 102 may identify a security threat (e.g., a malicious user is entering the same PIN at a number of proximate ATMs to withdraw funds within an hour, or the like). Additionally or alternatively, the cognitive automation platform 102 may maintain a threshold value corresponding to a number of times that a particular user interface progression may be used within a predetermined time period in a legitimate manner, and may compare the first ATM interaction information to this threshold value. For example, if the cognitive automation platform 102 determines, based on the first ATM interaction information, that the threshold value is exceeded, the cognitive automation platform 102 may identify a security threat. In some instances, the cognitive automation platform 102 may further identify that these various ATMs are within a predetermined distance of each other (e.g., a malicious user is performing the same activity at a number of proximate ATMs within an hour, or the like). Additionally or alternatively, the cognitive automation platform 102 may maintain a threshold withdrawal limit, above which an enterprise user device 104 is notified of the withdrawal, withdrawals are limited to a predetermined number, or the like, and the cognitive automation platform 102 may compare the first ATM interaction information to this threshold withdrawal limit. If the cognitive automation platform 102 determines that an amount of funds is below, but within a threshold amount of, the threshold withdrawal limit, more than a predetermined number of times, the cognitive automation platform 102 may identify a security threat (e.g., a malicious user is attempting to remain undetected and/or unrestricted by circumventing maximum withdrawal limits, or the like). Additionally or alternatively, the cognitive automation platform 102 may maintain a threshold amount of time that a user may be present at the first ATM 105 without interacting with the first ATM 105 before being flagged as suspicious (e.g., a user is just loitering at the first ATM 105). If the cognitive automation platform 102 determines that a user has been present for more an amount of time greater than the threshold amount of time and has not interacted with the first ATM, the cognitive automation platform 102 may identify a security threat.
In some instances, the cognitive automation platform 102 may maintain profiles for legitimate users (which may, in some instances, be tied to an account number). In these instances, the cognitive automation platform 102 may apply computer vision techniques to the first image data to compare an identified user to a legitimate user. In these instances, the cognitive automation platform 102 may identify the legitimate user based on a PIN number received at the first ATM 105. Similarly, the cognitive automation may compare audio from the first image data to compare an identified user to a legitimate user (e.g., using voice recognition). If the cognitive automation platform 102 determines that the identified user does not match the legitimate user, the cognitive automation platform 102 may identify a security threat.
In some instances, if a security threat is identified, the cognitive automation platform 102 may generate and maintain a profile for the malicious user (e.g., the first user) that includes image data (e.g., the first image data) and/or ATM interaction data (e.g., the first ATM interaction information) corresponding to the first user. In doing so, the cognitive automation platform 102 may be able to identify the first user at subsequent ATMs based on received ATM interaction information. In some instances, the cognitive automation platform 102 may format user profiles, image data, and/or ATM interaction information into a common protocol for intake by various enterprise devices (e.g., ATMs, user devices, or the like corresponding to the same or different enterprise organizations).
At step 209, the cognitive automation platform 102 may generate one or more commands directing the first ATM 105 to perform one or more security actions. For example, the cognitive automation platform 102 may generate one or more commands directing the first ATM 105 to cause display of one or more graphical user interfaces to be displayed at the first ATM 105, which may delay the user from completing a malicious activity. Additionally or alternatively, the cognitive automation platform 102 may generate one or more commands directing the first ATM 105 to lock. At step 210, the cognitive automation platform 102 may send the one or more commands directing the first ATM 105 to perform the one or more security actions, generated at step 209, to the first ATM 105. In some instances, the cognitive automation platform 102 may send the one or more commands directing the first ATM 105 to perform the one or more security actions via the communication interface 113 and while the first wireless data connection is established.
At step 211, the first ATM 105 may receive the one or more commands directing the first ATM 105 to perform the one or more security actions. In some instances, the first ATM 105 may receive the one or more commands directing the first ATM 105 to perform the one or more security actions while the first wireless data connection is established.
Referring to
At step 213, the cognitive automation platform 102 may generate one or more commands directing enterprise user device 104 and/or a law enforcement computing device to display a security notification. Additionally or alternatively, the cognitive automation platform 102 may generate one or more commands directing a physical perimeter surrounding the first ATM to be locked down. In some instances, the cognitive automation platform may generate the one or more commands directing enterprise user device 104 to display a security notification in response to determining that a branch of the enterprise organization maintaining the first ATM 105 is within a predetermined distance of the first ATM 105.
At step 214, the cognitive automation platform 102 may establish a connection with enterprise user device 104. In some instances, the cognitive automation platform 102 may establish a third wireless data connection with enterprise user device 104 to link the cognitive automation platform 102 to the enterprise user device 104. In some instances, the cognitive automation platform 102 may identify whether a connection is already established with the enterprise user device 104. If a connection is already established with the enterprise user device 104, the cognitive automation platform 102 might not re-establish the connection. If a connection is not already established with the enterprise user device 104, the cognitive automation platform 102 may establish the third wireless data connection as described herein.
At step 215, the cognitive automation platform 102 may send the one or more commands directing enterprise user device 104 to display a security notification. In some instances, the cognitive automation platform 102 may send the one or more commands directing enterprise user device to display the security notification via the communication interface 113 and while the third wireless data connection is established.
At step 216, the enterprise user device 104 may receive the one or more commands directing enterprise user device 104 to display a security notification. In some instances, the enterprise user device 104 may receive the one or more commands directing enterprise user device 104 to display a security notification while the third wireless data connection is established.
Referring to
At step 218, the second ATM 106 may establish a connection with cognitive automation platform 102. For example, the second ATM 106 may establish a fourth wireless data connection with cognitive automation platform 102 to link the second ATM 106 to the cognitive automation platform 102. In some instances, the second ATM 106 may identify whether a connection is already established with the cognitive automation platform 102. If a connection is already established with the cognitive automation platform 102, the second ATM 106 might not re-establish the connection. If a connection is not yet established with the cognitive automation platform 102, the second ATM 106 may establish the fourth wireless data connection as described herein.
At step 219, the second ATM 106 may send second ATM interaction information to the cognitive automation platform 102. In some instances, the second ATM may send the second ATM interaction information to the cognitive automation platform 102 while the fourth wireless data connection is established. For example, the second ATM 106 may send information corresponding to an interaction between the first user (e.g., who previously interacted with the first ATM 105) and the second ATM 106 (e.g., the first user has moved now to another ATM, which may correspond to the same enterprise organization as first ATM 105, or a different enterprise organization). Actions performed at step 219 may be similar to those described above at step 202 with regard to the first ATM 105.
At step 220, the cognitive automation platform 102 may receive the second ATM interaction information sent at step 219. In some instances, the cognitive automation platform 102 may receive the second ATM interaction information via the communication interface and while the fourth wireless data connection is established. Actions performed at step 220 may be similar to those described above at step 203 with regard to the first ATM interaction information.
At step 221, the second camera 107 may capture a second image. In some instances, the second camera 107 may be configured to capture images of a user interacting with the second ATM 106. In some instances, the second camera 107 may capture images at a predetermined interval (e.g., once a minute, or the like). In other instances, the second camera 107 may receive one or more commands from the cognitive automation platform 102, which may indicate that tampering has been detected (e.g., based on the second ATM interaction information, and that an image should be captured). In some instances, the second camera 107 may capture video content, images, audio content, or the like corresponding to the first user. Actions performed at step 221 may be similar to those described above with regard to step 204.
Referring to
At step 223, the second camera 107 may send second image data to the cognitive automation platform 102. In some instances, the second camera 107 may send the second image data to the cognitive automation platform 102 while the fifth wireless data connection is established. In some instances, the second camera 107 may send second image data corresponding to the first user interacting with the second ATM 106. In some instances, the second camera 107 may send video data, audio data, image data, or the like to the cognitive automation platform 102. In some instances, in sending the second image data to the cognitive automation platform 102, the second camera 107 may establish a live video stream between the first camera 103 and the cognitive automation platform 102. Actions performed at step 223 may be similar to those described above at step 206 with regard to the first camera 103.
At step 224, the cognitive automation platform 102 may receive the second image data sent at step 223. In some instances, the cognitive automation platform 102 may receive the second image data via the communication interface 113 and while the fifth wireless data connection is established. In some instances, the cognitive automation platform 102 may receive second image data corresponding to the first user interacting with the second ATM 106. In some instances, the cognitive automation platform 102 may receive video data, audio data, image data, or the like from the second camera 107. In some instances, in receiving the second image data, the cognitive automation platform 102 may receive a live video stream from the second camera 107. It should be understood that, in some instances, steps 218-224 may occur concurrently (e.g., second ATM interaction information and second image data may be collected and sent to the cognitive automation platform 102 simultaneously). Furthermore, it should be understood that although a single camera is described, multiple cameras may be implemented to collect images of the first user from multiple vantage points.
At step 225, the cognitive automation platform 102 may compare the first image data, received at step 207, to the second image data, received at step 224. For example, the cognitive automation platform 102 may apply computer vision methods to analyze the two sets of image data and generate an image comparison score.
At step 226, the cognitive automation platform 102 may compare the comparison score, computed at step 225, to a predetermined comparison threshold. If the cognitive automation platform 102 identifies that the comparison score exceeds the comparison threshold, the cognitive automation platform 102 may identify that the user interacting the with second ATM 106 is the same user that interacted with the first ATM 105 (e.g., which is the first user).
Referring to
At step 228, the cognitive automation platform 102 may send the one or more commands directing the second ATM 106 to perform the one or more security actions, generated at step 228, to the second ATM 106. In some instances, the cognitive automation platform 102 may send the one or more commands directing the second ATM 106 to perform the one or more security actions via the communication interface 113 and while the fourth wireless data connection is established. Actions performed at step 228 may be similar to those described above with regard to step 210.
At step 229, the second ATM 106 may receive the one or more commands directing the second ATM 106 to perform the one or more security actions. In some instances, the second ATM 106 may receive the one or more commands directing the second ATM 106 to perform the one or more security actions while the fourth wireless data connection is established. Actions performed at step 230 may be similar to those described above with regard to step 211.
At step 230, the second ATM 106 may perform, in response to receiving the one or more commands directing the second ATM 106 to perform the one or more security actions, the one or more security actions. For example, the second ATM 106 may cause display of a user interface similar to graphical user interfaces 305 and/or 405, which are shown in
At step 620, the computing platform may generate and send one or more commands directing the first ATM to perform one or more security actions. At step 625, the computing platform may identify whether a branch location is within a predetermined distance of the first ATM. If a branch location is within the predetermined distance of the first ATM, the computing platform may proceed to step 630. If a branch location is not within the predetermined distance of the first ATM, the computing platform may proceed to step 635.
At step 630, the computing platform may generate and send one or more commands directing an enterprise user device to perform one or more security actions. At step 635, the computing platform may receive second ATM interaction corresponding to an interaction between the user and a second ATM. At step 640, the computing platform may receive second image data from a second camera corresponding to a second image of the user. At step 645, the computing platform may compare the first image and the second image to determine whether there is a match between the two images. If there is not a match between the two images, the method may end. If the computing platform determines that there is a match between the two images, the computing platform may proceed to step 650. At step 650, the computing platform may generate and send one or more commands directing the third ATM to perform one or more security actions.
One or more aspects of the disclosure may be embodied in computer-usable data or computer-executable instructions, such as in one or more program modules, executed by one or more computers or other devices to perform the operations described herein. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types when executed by one or more processors in a computer or other data processing device. The computer-executable instructions may be stored as computer-readable instructions on a computer-readable medium such as a hard disk, optical disk, removable storage media, solid-state memory, RAM, and the like. The functionality of the program modules may be combined or distributed as desired in various embodiments. In addition, the functionality may be embodied in whole or in part in firmware or hardware equivalents, such as integrated circuits, application-specific integrated circuits (ASICs), field programmable gate arrays (FPGA), and the like. Particular data structures may be used to more effectively implement one or more aspects of the disclosure, and such data structures are contemplated to be within the scope of computer executable instructions and computer-usable data described herein.
Various aspects described herein may be embodied as a method, an apparatus, or as one or more computer-readable media storing computer-executable instructions. Accordingly, those aspects may take the form of an entirely hardware embodiment, an entirely software embodiment, an entirely firmware embodiment, or an embodiment combining software, hardware, and firmware aspects in any combination. In addition, various signals representing data or events as described herein may be transferred between a source and a destination in the form of light or electromagnetic waves traveling through signal-conducting media such as metal wires, optical fibers, or wireless transmission media (e.g., air or space). In general, the one or more computer-readable media may be and/or include one or more non-transitory computer-readable media.
As described herein, the various methods and acts may be operative across one or more computing servers and one or more networks. The functionality may be distributed in any manner, or may be located in a single computing device (e.g., a server, a client computer, and the like). For example, in alternative embodiments, one or more of the computing platforms discussed above may be combined into a single computing platform, and the various functions of each computing platform may be performed by the single computing platform. In such arrangements, any and/or all of the above-discussed communications between computing platforms may correspond to data being accessed, moved, modified, updated, and/or otherwise used by the single computing platform. Additionally or alternatively, one or more of the computing platforms discussed above may be implemented in one or more virtual machines that are provided by one or more physical computing devices. In such arrangements, the various functions of each computing platform may be performed by the one or more virtual machines, and any and/or all of the above-discussed communications between computing platforms may correspond to data being accessed, moved, modified, updated, and/or otherwise used by the one or more virtual machines.
Aspects of the disclosure have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications, and variations within the scope and spirit of the appended claims will occur to persons of ordinary skill in the art from a review of this disclosure. For example, one or more of the steps depicted in the illustrative figures may be performed in other than the recited order, and one or more depicted steps may be optional in accordance with aspects of the disclosure.
| Patent | Priority | Assignee | Title |
| Patent | Priority | Assignee | Title |
| 10769896, | May 01 2019 | Capital One Services, LLC | Counter-fraud measures for an ATM device |
| 11042850, | Dec 31 2014 | FISERV, INC | Card account identifiers associated with conditions for temporary use |
| 5155803, | Jun 08 1989 | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | Expert system for performing beta-token partitioning in a RETE network |
| 20060028341, | |||
| 20070112696, | |||
| 20080070217, | |||
| 20080191860, | |||
| 20080251578, | |||
| 20100025463, | |||
| 20120038774, | |||
| 20120097404, | |||
| 20120330869, | |||
| 20140305352, | |||
| 20140320664, | |||
| 20150355649, | |||
| 20160148179, | |||
| 20170255671, | |||
| 20180204204, | |||
| 20180239377, | |||
| 20180365617, | |||
| 20190220863, | |||
| 20190244149, | |||
| 20190306011, | |||
| 20190347282, | |||
| 20190349321, | |||
| 20200005616, | |||
| 20200022016, | |||
| 20200097357, | |||
| 20210192523, |
| Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
| Mar 30 2020 | Bank of America Corporation | (assignment on the face of the patent) | / | |||
| Mar 30 2020 | SANGHVI, SITEN | Bank of America Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 052260 | /0435 |
| Date | Maintenance Fee Events |
| Mar 30 2020 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
| Date | Maintenance Schedule |
| May 31 2025 | 4 years fee payment window open |
| Dec 01 2025 | 6 months grace period start (w surcharge) |
| May 31 2026 | patent expiry (for year 4) |
| May 31 2028 | 2 years to revive unintentionally abandoned end. (for year 4) |
| May 31 2029 | 8 years fee payment window open |
| Dec 01 2029 | 6 months grace period start (w surcharge) |
| May 31 2030 | patent expiry (for year 8) |
| May 31 2032 | 2 years to revive unintentionally abandoned end. (for year 8) |
| May 31 2033 | 12 years fee payment window open |
| Dec 01 2033 | 6 months grace period start (w surcharge) |
| May 31 2034 | patent expiry (for year 12) |
| May 31 2036 | 2 years to revive unintentionally abandoned end. (for year 12) |